1. Member States shall ensure that there are effective systems of investigations and sanctions to detect, correct and prevent inadequate execution of the statutory audit.
2. Without prejudice to Member States' civil liability regimes, Member States shall provide for effective, proportionate and dissuasive sanctions in respect of statutory auditors and audit firms, where statutory audits are not carried out in conformity with the provisions adopted in the implementation of this Directive, and, where applicable, Regulation (EU) No 537/2014.
Member States may decide not to lay down rules for administrative sanctions for infringements which are already subject to national criminal law. In that event, they shall communicate to the Commission the relevant criminal law provisions.
3. Member States shall provide that measures taken and sanctions imposed on statutory auditors and audit firms are to be appropriately disclosed to the public. Sanctions shall include the possibility of withdrawal of approval. Member States may decide that such disclosure shall not contain personal data within the meaning of point (a) of Article 2 of Directive 95/46/EC.
4. By 17 June 2016 the Member States shall notify the rules referred to in paragraph 2 to the Commission. They shall notify the Commission without delay of any subsequent amendment thereto.
1. Member States shall provide for competent authorities to have the power to take and/or impose at least the following administrative measures and sanctions for breaches of the provisions of this Directive and, where applicable, of Regulation (EU) No 537/2014:
(a) a notice requiring the natural or legal person responsible for the breach to cease the conduct and to abstain from any repetition of that conduct;
(b) a public statement which indicates the person responsible and the nature of the breach, published on the website of competent authorities;
(c) a temporary prohibition, of up to three years' duration, banning the statutory auditor, the audit firm or the key audit partner from carrying out statutory audits and/or signing audit reports;
(d) a declaration that the audit report does not meet the requirements of Article 28 of this Directive or, where applicable, Article 10 of Regulation (EU) No 537/2014;
(e) a temporary prohibition, of up to three years' duration, banning a member of an audit firm or a member of an administrative or management body of a public-interest entity from exercising functions in audit firms or public-interest entities;
(f) the imposition of administrative pecuniary sanctions on natural and legal persons.
2. Member States shall ensure that the competent authorities are able to exercise their sanctioning powers in accordance with this Directive and national law and in any of the following ways:
(a) directly;
(b) in collaboration with other authorities;
(c) by application to the competent judicial authorities.
3. Member States may confer on competent authorities other sanctioning powers in addition to those referred to in paragraph 1.
4. By way of derogation from paragraph 1, Member States may confer on authorities supervising public-interest entities, when they are not designated as the competent authority pursuant to Article 20(2) of Regulation (EU) No 537/2014, powers to impose sanctions for breaches of reporting duties provided for by that Regulation.
When laying down rules pursuant to Article 30, Member States shall require that, when determining the type and level of administrative sanctions and measures, competent authorities are to take into account all relevant circumstances, including where appropriate:
the gravity and the duration of the breach;
the degree of responsibility of the responsible person;
the financial strength of the responsible person, for example as indicated by the total turnover of the responsible undertaking or the annual income of the responsible person, if that person is a natural person;
the amounts of the profits gained or losses avoided by the responsible person, in so far as they can be determined;
the level of cooperation of the responsible person with the competent authority;
previous breaches by the responsible legal or natural person.
Additional factors may be taken into account by competent authorities, where such factors are specified in national law.
1. Competent authorities shall publish on their official website at least any administrative sanction imposed for breach of the provisions of this Directive or of Regulation (EU) No 537/2014 in respect of which all rights of appeal have been exhausted or have expired, as soon as reasonably practicable immediately after the person sanctioned has been informed of that decision, including information concerning the type and nature of the breach and the identity of the natural or legal person on whom the sanction has been imposed.
Where Member States permit publication of sanctions which are subject to appeal, competent authorities shall, as soon as reasonably practicable, also publish on their official website information concerning the status and outcome of any appeal.
2. Competent authorities shall publish the sanctions imposed on an anonymous basis, and in a manner which is in conformity with national law, in any of the following circumstances:
(a) where, in the event that the sanction is imposed on a natural person, publication of personal data is shown to be disproportionate by an obligatory prior assessment of the proportionality of such publication;
(b) where publication would jeopardise the stability of financial markets or an ongoing criminal investigation;
(c) where publication would cause disproportionate damage to the institutions or individuals involved.
3. Competent authorities shall ensure that any publication in accordance with paragraph 1 is of proportionate duration and that it remains on their official website for a minimum period of five years after all rights of appeal have been exhausted or have expired.
The publication of sanctions and measures and of any public statement shall respect fundamental rights as laid down in the Charter of Fundamental Rights of the European Union, in particular the right to respect for private and family life and the right to the protection of personal data. Member States may decide that such publication or any public statement is not to contain personal data within the meaning of point (a) of Article 2 of Directive 95/46/EC.
Member States shall ensure that decisions taken by the competent authority in accordance with this Directive and Regulation (EU) No 537/2014 are subject to a right of appeal.
1. Member States shall ensure that effective mechanisms are established to encourage reporting of breaches of this Directive or of Regulation (EU) No 537/2014 to the competent authorities.
2. The mechanisms referred to in paragraph 1 shall include at least:
(a) specific procedures for the receipt of reports of breaches and their follow-up;
(b) protection of personal data concerning both the person who reports the suspected or actual breach and the person who is suspected of committing, or who has allegedly committed that breach, in compliance with the principles laid down in Directive 95/46/EC;
(c) appropriate procedures to ensure the right of the accused person to a defence and to be heard before the adoption of a decision concerning him or her, and the right to seek an effective remedy before a tribunal against any decision or measure concerning him or her.
3. Member States shall ensure that audit firms establish appropriate procedures for their employees to report potential or actual breaches of this Directive or of Regulation (EU) No 537/2014 internally through a specific channel.
1. Competent authorities shall provide the CEAOB annually with aggregated information regarding all administrative measures and all sanctions imposed in accordance with this chapter. The CEAOB shall publish that information in an annual report.
2. Competent authorities shall immediately communicate to the CEAOB all temporary prohibitions referred to in points c) and e) of Article 30a(1).]